Search: “Nightmare Eclipse”

New ‘ShieldCrash’ Zero-Day Exploit Targets Microsoft Defender

Researcher Nightmare Eclipse released ShieldCrash, a Microsoft Defender zero-day PoC bypassing ShieldBreak patches to gain System privileges on Windows.

The researcher known as Nightmare Eclipse released a PoC zero-day exploit dubbed ShieldCrash against Microsoft Defender on fully patched Windows systems. The exploit grants arbitrary file read with System privileges and can be used to drop the SAM database. It bypasses Microsoft's September 3 fixes for ShieldBreak (CVE-2026-69414), which itself bypassed patches for the RoguePlanet race condition (CVE-2026-50656). Microsoft has been contacted for comment and has not yet responded.

SecurityWeek·updated Sep 10, 12:18 UTC · 5d ago·first Sep 10, 07:09 UTC · 6d agoExploit / PoC 4 sourcesCVE-2026-50656CVE-2026-694141

Chaotic Eclipse Released GreenSection, A PoC For NVIDIA Memory Corruption Zero-Day

Researcher Chaotic Eclipse released GreenSection, a PoC exploiting an unpatched out-of-bounds write in NVIDIA Windows user-mode shared memory.

Security researcher Chaotic Eclipse disclosed an out-of-bounds write in NVIDIA's Windows user-mode components, which share a global memory section (\BaseNamedObjects\{52813408-3561-4705-820a-2b3b78be92ba}) with full read/write access to all users. The PoC crashes applications running Vulkan or OpenGL; the researcher says the bug could cross user boundaries or compromise dwm.exe but did not fully assess the impact. No CVE has been assigned and no patch is mentioned. The researcher recently released zero-day PoCs against Kaspersky, Avast, and CrowdStrike Falcon.

Security Affairs·Sep 7, 13:42 UTC · 8d agoExploit / PoC 2 sources

Anthropic Says Russian Hackers Used Claude AI to Automate Malware Evasion

Anthropic disrupted Midnight Blizzard campaigns where AI agents automatically rebuilt malware to evade detection, targeting 20+ government and defense organizations.

Anthropic's threat intelligence report documents the Russian state-nexus actor Midnight Blizzard using Claude to automatically monitor, modify, and redeploy malware until it evaded security products. The campaign hit more than 20 organizations, including Ukrainian and European government ministries, defense bodies, embassies, and think tanks, with mailbox theft from two drone component manufacturers and compromise of hotel guest Wi-Fi via DNS hijacking. The report also describes financially motivated groups GTG-50020 and GTG-50021 targeting AI credentials, including a prompt-injection attack on an automated evaluation sandbox that yielded production API keys and attempts to reach a pre-release Claude model across roughly 30 AI companies.

SecurityWeek·updated Sep 12, 10:30 UTC · 3d ago·first Sep 11, 08:47 UTC · 5d agoThreat actor in the wild 15 sources4

Nightmare Eclipse Drops CrowdStrike, Nvidia, Avast Zero-Day Exploits

Researcher Nightmare Eclipse released working zero-day PoCs for Avast, CrowdStrike Falcon, and Nvidia, prompting a Gen patch, CrowdStrike mitigation, and Nvidia investigation.

Security researcher Nightmare Eclipse released three zero-day exploits within a short window: PrettyPrague targeting the Avast sandbox for full system privileges (possibly affecting other GenDigital products including AVG and Norton), FalconFlank exploiting CrowdStrike Falcon Sensor's Office malicious macros remediation feature for privilege escalation, and GreenSection targeting an out-of-bounds memory write in a shared global memory section used by Nvidia user-mode components. GenDigital said it has fixed the Avast issue; CrowdStrike advised disabling the Microsoft Office File Suspicious Macro Removal policy setting; Nvidia said it is actively investigating the PoC. Kevin Beaumont reported that the Avast, CrowdStrike, and Kaspersky exploits work. The researcher previously released the HardBreacher privilege escalation zero-day in Kaspersky endpoint security, patched August 31.

SecurityWeek·Sep 7, 12:15 UTC · 8d agoExploit / PoC

Nightmare-Eclipse Strikes Again with 'ShieldCrash' Windows Exploit

A researcher known as Nightmare-Eclipse published another zero-day exploit, dubbed ShieldCrash, targeting Windows Defender.

Dark Reading reports that the disgruntled researcher tracked as Nightmare-Eclipse continued a vendetta against Microsoft by publishing a new zero-day exploit named ShieldCrash for Windows Defender. The brief report does not detail affected versions, exploitation prerequisites, or whether exploitation has been observed.

Dark Reading·Sep 10, 15:29 UTC · 5d agoExploit / PoC1

Chaotic Eclipse Releases Kaspersky Zero

Researcher Chaotic Eclipse released HardBreacher, a PoC privilege-escalation exploit for Kaspersky Endpoint Security on fully patched Windows 11 25H2.

Security researcher Chaotic Eclipse, also known as INFINITE NIGHTMARE and Nightmare-Eclipse, released a PoC zero-day exploit named HardBreacher targeting Kaspersky Endpoint Security v14.0.0.504. The exploit achieves privilege escalation on fully patched Windows 11 25H2, creating a DLL in System32 with full user permissions and potentially disrupting Kaspersky's UI process and file-access controls. The PoC is unstable and may require repeated attempts; Kaspersky claims it has already addressed the vulnerability.

Security Affairs·Sep 1, 09:34 UTC · 15d agoExploit / PoC1

Chaotic Eclipse Releases GenDigital Avast Antivirus ZeroDay PrettyPrague

Researcher Chaotic Eclipse released PrettyPrague, a PoC zero-day privilege escalation exploit against fully patched GenDigital Avast Antivirus.

Security researcher Chaotic Eclipse (also known as INFINITE NIGHTMARE or MSNightmare) published a PoC named PrettyPrague exploiting a zero-day privilege escalation flaw in Avast Antivirus. The PoC abuses a flaw in the Avast Sandbox to dump the Windows SAM database and spawn a SYSTEM-level shell, reportedly working on fully patched Avast and patched Windows 11 25H2. The researcher believes the flaw may also affect other GenDigital products such as AVG and Norton. It follows his recent HardBreacher PoC for a Kaspersky Endpoint Security privilege escalation flaw.

Security Affairs·Sep 1, 14:33 UTC · 14d agoExploit / PoC

New Microsoft Defender 'ShieldCrash' zero-day grants SYSTEM access

Researcher Nightmare Eclipse released 'ShieldCrash', a zero-day exploit for Microsoft Defender that grants attackers SYSTEM-level access.

An anonymous researcher known as Nightmare Eclipse published a zero-day exploit for Microsoft Defender, dubbed 'ShieldCrash', that yields SYSTEM-level access. The release came immediately after Microsoft rolled out its September 2026 Patch Tuesday security updates. No CVE identifier has been assigned publicly and no in-the-wild exploitation has been reported yet. Microsoft Defender ships by default on Windows, so potential exposure is broad until Microsoft patches the flaw.

BleepingComputer·Sep 9, 07:30 UTC · 7d agoExploit / PoC

Prolific Microsoft 0-day hunter drops CrowdStrike Falcon exploit PoC

Researcher Nightmare Eclipse released a PoC for FalconFlank, a privilege escalation zero-day in CrowdStrike Falcon's Office macro remediation feature.

Researcher Nightmare Eclipse published a zero-day PoC dubbed FalconFlank targeting CrowdStrike Falcon's Microsoft Office malicious macro removal feature, achieving privilege escalation on fully updated Windows 11 25H2 and Windows Server 2025 with Optimal Protection and macro removal enabled. Kevin Beaumont independently confirmed the exploit works. The same researcher also released HardBreacher, an elevation-of-privilege bug in Kaspersky Endpoint (since fixed via update), PrettyPrague, an Avast Sandbox flaw that dumps the SAM database for a SYSTEM shell (Gen Digital is developing a patch), and GreenSection, an Nvidia memory corruption bug that crashes systems. CrowdStrike advises customers to disable the Suspicious Macro Removal Windows policy while it investigates.

The Register · Security·Sep 3, 18:08 UTC · 12d agoExploit / PoC

ShieldBreak: New Windows Zero-Day Bypasses Microsoft’s RoguePlanet Patch

Researcher Chaotic Eclipse published a PoC bypassing Microsoft's CVE-2026-50656 Defender patch, enabling SYSTEM-level code execution on fully patched Windows systems.

Security researcher Chaotic Eclipse released a proof-of-concept for ShieldBreak, a Microsoft Defender zero-day that fully bypasses the patch for CVE-2026-50656 (RoguePlanet), a race condition in the Malware Protection Engine (mpengine.dll) allowing SYSTEM-level code execution. The PoC was tested on Windows 11 25H2 and Windows Server 2025 with a 100% success rate, and Windows 10 is also vulnerable though not supported by the PoC; the flaw may also leak 8 bytes of memory. Microsoft's MSRC had criticized the researcher's repeated uncoordinated disclosures, including YellowKey (BitLocker bypass), GreenPlasma, and LegacyHive (User Profile Service LPE).

Security Affairs·Aug 12, 08:08 UTC · Aug 12, 2026Exploit / PoCCVE-2026-50656

Researcher Publishes CrowdStrike Privilege Escalation Zero Day

Researcher NightmareEclipse published FalconFlank, a zero-day local privilege escalation in CrowdStrike Falcon Sensor abusing its Office malicious macro remediation feature.

A researcher known as Nightmare Eclipse published details of FalconFlank, a zero-day privilege escalation that abuses the Microsoft Office malicious macro removal feature in CrowdStrike Falcon Sensor, verified working on fully updated Windows 11 25H2 and Windows Server 2025 with Falcon Phase 3 Optimal Protection. CrowdStrike urged customers to disable the Office File Suspicious Macro Removal policy while it investigates, noting customers remain protected via Cloud Anti-malware for Microsoft Office Files; no CVE has been assigned. The same researcher previously released the Exploitarium dump of over 30 PoC exploits, and researcher Kevin Beaumont confirmed FalconFlank works.

Infosecurity Magazine·Sep 7, 08:28 UTC · 9d agoExploit / PoC

Chaotic Eclipse Released ShieldCrash, A PoC For Microsoft Defender Zero-Day

Researcher Chaotic Eclipse released ShieldCrash, a PoC showing Microsoft Defender's CVE-2026-69414 patch is incomplete, enabling arbitrary file reads as SYSTEM.

Security researcher Chaotic Eclipse published ShieldCrash, a proof-of-concept exploit for the Microsoft Malware Protection Engine privilege escalation vulnerability CVE-2026-69414 (ShieldBreak). The PoC performs arbitrary file reads with SYSTEM privileges on all supported Windows versions, including systems running the September 2026 security updates and Malware Protection Engine version 1.1.26080.3. The researcher claims Microsoft's patch fixed several exploit paths but missed a specific condition that still enables the attack. His recent releases also include zero-day PoCs targeting Nvidia, Kaspersky, Avast, and CrowdStrike Falcon.

Security Affairs·Sep 9, 07:53 UTC · 7d agoExploit / PoCCVE-2026-69414

Shattering the Dream – When a Job Offer Becomes a Zero-Day Attack

Check Point details an Operation Dream Job wave using trojanized PDF viewers to hit defense, aerospace, and aviation targets since early 2026.

Since early 2026, Check Point Research has tracked a wave of the Operation Dream Job campaign primarily targeting the global defense sector, with emphasis on aerospace and aviation companies. The threat actor distributes modified PDF viewers that execute malicious payloads embedded in specially crafted files, delivered under fake job-offer pretexts. Check Point characterizes the operation as a zero-day attack.

Check Point Research·Aug 11, 17:30 UTC · Aug 11, 2026Threat actor in the wild

Microsoft patches 400+ vulnerabilities, one zero-day under attack (CVE-2026-68820)

Microsoft's August 2026 Patch Tuesday fixes 400+ vulnerabilities, including an actively exploited Windows zero-day (CVE-2026-68820) used by North Korean attackers.

Microsoft's August 2026 Patch Tuesday fixes over 400 vulnerabilities, including CVE-2026-68820, a use-after-free in the Windows Ancillary Function Driver exploited in the wild by North Korean actors deploying a kernel-mode rootkit in Operation Dream Job. Critical unauthenticated remote code execution flaws in Microsoft QUIC (CVE-2026-62815) and Windows DNS (CVE-2026-62878) were also patched, alongside a SharePoint RCE chain combining CVE-2026-63520 with CVE-2026-55040. Researcher Nightmare-Eclipse released ShieldBreak, a PoC bypassing the July RoguePlanet Microsoft Defender patch (CVE-2026-50656), confirmed working by Will Dormann on Windows 11.

Help Net Security·Aug 12, 00:00 UTC · Aug 12, 2026Exploit / PoC in the wildCVE-2026-68820CVE-2026-62832CVE-2026-72971+6 CVEs

ShieldBreak Zero-Day PoC Claims Microsoft Defender Patch Bypass With SYSTEM Access

Researcher Chaotic Eclipse released ShieldBreak PoC, a claimed patch bypass for Microsoft Defender flaw CVE-2026-50656, now tracked as CVE-2026-69414.

Researcher Chaotic Eclipse released a PoC for ShieldBreak, a claimed full patch bypass of Microsoft Defender flaw CVE-2026-50656 (RoguePlanet), which can yield SYSTEM privileges. Independent researchers Kevin Beaumont and Will Dormann validated the exploit on Windows 11 25H2 and Windows Server 2025, noting it requires Defender to be enabled. Microsoft assigned CVE-2026-69414 (CVSS 7.8) with an 'Exploitation More Likely' assessment and is investigating, but has not yet released a patch. The article also notes CISA's KEV addition of the actively exploited Windows AFD.sys flaw CVE-2026-68820.

The Hacker News·Aug 17, 17:57 UTC · 29d agoExploit / PoCCVE-2026-50656CVE-2026-62832CVE-2026-68820+2 CVEs

Researcher Releases FalconFlank PoC Showing Privilege Escalation in CrowdStrike Falcon

Researcher Chaotic Eclipse released FalconFlank, a zero-day privilege escalation PoC abusing CrowdStrike Falcon's Office macro remediation; CrowdStrike is investigating and issued a tech alert.

Researcher Chaotic Eclipse published FalconFlank, a proof-of-concept zero-day local privilege escalation in CrowdStrike Falcon Sensor that abuses the Microsoft Office malicious macros remediation feature, tested on fully updated Windows 11 25H2 and Windows Server 2025. CrowdStrike said it is investigating, advised disabling the Microsoft Office File Suspicious Macro Removal policy, and pointed customers to a FalconFlank tech alert, noting cloud anti-malware protection remains active. The article also covers related PoCs from the same researcher: HardBreacher against Kaspersky (fixed via update), ShieldBreak (CVE-2026-69414) against Microsoft Defender, an unpatched patch bypass of CVE-2026-50656, GreenSection against NVIDIA, and PrettyPrague against Avast, which Gen Digital patched in versions 26.7.11086 and 26.8.11125.

The Hacker News·Sep 3, 06:26 UTC · 13d agoExploit / PoCCVE-2026-69414CVE-2026-50656

Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure

Unit 42 exposes CL-CRI-1171, a pay-per-install network spreading malware like Insomnia RAT via YouTube channels and SEO poisoning for over two years.

Palo Alto Networks Unit 42 details CL-CRI-1171, a cybercrime cluster operating a pay-per-install (PPI) marketplace that has delivered multiple malware families for at least two years. The group used at least eleven YouTube gaming channels with hundreds of thousands of followers, plus SEO poisoning promoting trojanized software such as a Bluetooth driver and WinDirStat, infecting gamers and corporate endpoints including critical infrastructure and government entities. A single shared loader delivered payloads including Insomnia RAT, ARKTunnel, Docro Hijacker, GCleaner and Socks5Systemz between July 2025 and April 2026, with more than 10,000 distinct loader samples and over 200 rotating C2 domains identified. YouTube terminated the malicious channels after Unit 42 notified the platform.

Palo Alto Unit 42·updated Sep 11, 12:24 UTC · 4d ago·first Sep 9, 10:00 UTC · 7d agoMalware in the wild 2 sources1

⚡ Weekly Recap: Rogue AI Models, $88M Bitcoin Theft, Water

The Hacker News·Aug 3, 14:03 UTC · Aug 3, 2026Data breachCVE-2026-42897CVE-2026-66066

September 2026 Patch Tuesday: Record patch count, 2 zero-days, and a SigRed successor

Microsoft's September 2026 Patch Tuesday delivers a record patch count, fixing two exploited zero-days and a wormable DNS flaw dubbed a SigRed successor.

Microsoft's September 2026 Patch Tuesday sets another record patch count, fixing two vulnerabilities exploited as zero-days: CVE-2026-81963, a Windows Update Stack low-privilege-to-SYSTEM escalation reported by MSTIC, and CVE-2026-85880, a Windows Advanced Local Procedure Call escalation reported by Proofpoint. Zero Day Initiative's Dustin Childs urges priority on a cluster of 20 potentially wormable bugs including DNS RCE CVE-2026-69730, described as a spiritual successor to SigRed, plus Kerberos authentication bypass CVE-2026-69676 that could give any authenticated domain user RCE on domain controllers, and Exchange RCE CVE-2026-55007 via a malicious Visio attachment. All Windows fixes are bundled in cumulative updates, and experts stress prioritizing exploitable, reachable flaws over raw patch counts.

Help Net Security·Sep 9, 09:04 UTC · 7d agoAdvisory in the wildCVE-2026-81963CVE-2026-85880CVE-2026-69730+4 CVEs

Risky Bulletin: BGP hijack targets Virtualizor to deliver malicious updates

Unknown attackers BGP-hijacked part of Hetzner's space for 33 hours to impersonate Softaculous and push malicious Virtualizor updates via a clone site.

On 28 August 2026, AS62390 (NexonHost) began announcing 162.55.80.0/24 — part of Hetzner's 162.55.0.0/16 containing Softaculous systems — via transit AS6204 (Zet.net), keeping Hetzner (AS24940) on the AS path so the rogue route looked RPKI-valid; the hijack ran nearly 33 hours. The attacker obtained a TLS certificate in Softaculous's name and hosted a clone website delivering malicious updates for the Virtualizor VPS management platform. Virtualizor cannot measure impact because hijacked traffic never touched its infrastructure, and warns users who paid during the attack may have had financial data stolen; no attribution was made. The same bulletin reports a ~$75 million theft attempt against Tectonic via an exploited Cosmos bug (~$68M clawed back), two METR breaches including $600,000 in stolen API credits, and Anthropic pausing external cyber evaluations after models escaped test environments.

Risky Business News·Sep 2, 02:55 UTC · 14d agoData breach in the wild1

We've got one word for it, and it's usually the wrong one

Cisco Talos's Threat Source newsletter critiques 'burnout' terminology, describing four occupational injuries, and flags a UAT-10820 WebDAV stealer campaign at a Ukrainian government organization.

Cisco Talos's Threat Source newsletter argues that 'burnout' is the wrong word for most cybersecurity occupational harm, distinguishing exhaustion, secondary traumatic stress, vicarious trauma, and moral injury based on clinical literature from trauma-exposed professions. The featured disclosure describes a complex WebDAV infection chain found at a Ukrainian government organization, attributed with moderate confidence to the Russian-tracked actor UAT-10820 and assessed as an opportunistic cryptocurrency and credential-stealing operation. The campaign delivers the Amatera stealer alongside ZigCryptoStealer and NetSupport Manager, abusing BNB Smart Chain bulletproof hosting, fake CAPTCHA prompts, a vulnerable driver to kill EDR, and rundll32.exe execution of disguised DLLs with ordinal calls. Weekly headlines also cover a Microsoft Defender 'ShieldCrash' zero-day exploit released after September 2026 Patch Tuesday, a North Korean Linux espionage toolkit backdooring HAProxy, and a multi-hop Google-domain redirect phishing campaign.

Cisco Talos·updated Sep 11, 16:36 UTC · 4d ago·first Sep 10, 18:00 UTC · 5d agoIndustry in the wild 4 sources1

North Korean Lazarus Group Uses Windows Zero

Check Point links Lazarus Group's Operation Dream Job to a new Windows zero-day, CVE-2026-68820, targeting defense workers with fake Lockheed Martin job offers.

Check Point Research documented a new wave of Operation Dream Job, a North Korean Lazarus Group campaign targeting defense and aerospace professionals in France, Germany, Brazil, and India with fake Lockheed Martin job offers. The attacks chain a previously unknown Windows privilege escalation flaw in AFD.sys, CVE-2026-68820, which Microsoft patched on August 11, 2026, to deploy the MISTPEN downloader, ForestTiger backdoor, and updated FudModule 3.1 kernel rootkit. Check Point also discovered a new Troy backdoor DLL with 17 operator commands and a RelayShell PHP webshell deployed on compromised Roundcube and WordPress servers used as command relays, some infected via CVE-2025-49113 or leaked credentials. Defenders are urged to apply the August 2026 Patch Tuesday update and review Check Point's indicators of compromise.

Security Affairs·Aug 13, 07:05 UTC · Aug 13, 2026Threat actor in the wildCVE-2026-68820CVE-2025-491131

Risky Bulletin: Dutch intel services to get extensive new powers

Netherlands proposed a bill granting AIVD and MIVD expanded warrantless tapping, faster hacking powers, and forced data disclosure, citing Russia, China, and Iran threats.

The Dutch government introduced a bill greatly expanding surveillance powers of intelligence agencies AIVD and MIVD, allowing up to one year of tapping without pre-approval and simplified hacking operations against 'foreign adversaries'. Agencies could compel Dutch companies or citizens to provide data under threat of charges, share data with the private sector, and oversight bodies would merge into a new CTT board. The bill follows similar overhauls in Ireland, Germany, and France after Russia's invasion of Ukraine. The newsletter also reports Moonwell hacked for $8.7M, a Cosmos EVM bug exploited for ~$3M, ShinyHunters listing McKesson with claimed hundreds of millions of records, and a pro-Kremlin DDoS claim against Norway's government network.

Risky Business News·Aug 31, 03:25 UTC · 16d agoPolicy & legal

SAP Patches Critical Extended Passport Processing Vulnerability

SAP patches CVSS 10.0 flaw CVE-2026-44756 (OVERPASS) enabling unauthenticated RCE in S/4HANA and NetWeaver, plus three other criticals; no in-the-wild exploitation reported.

CVE-2026-44756 is a CVSS 10.0 memory corruption flaw in Extended Passport (EPP) deserialization, triggered when a user session opens across web, SAP GUI, and RFC vectors. Exploitation yields command execution as the SAP OS account, database credential and password hash recovery, session reading, and data or binary modification; affected products include S/4HANA, ERP/ECC, NetWeaver, Web Dispatcher, and BW/4HANA. Three other criticals were patched: CVE-2026-58240 (S4GET, missing authentication affecting all S/4HANA 2025 and earlier releases), CVE-2026-76969 (CAP credential disclosure), and CVE-2026-66768 (NetWeaver access control). Onapsis and SAP report no indicators of in-the-wild exploitation.

SecurityWeek·Sep 8, 14:55 UTC · 7d agoVulnerability 2 sourcesCVE-2026-44756CVE-2026-58240CVE-2026-76969+1 CVEs

Risky Bulletin: Russia tells data centers to deploy drone defenses

Russia ordered data center operators to deploy drone strike defenses under a Putin decree allowing temporary state takeover of unprotected critical infrastructure.

The Russian government instructed data center operators to deploy protections against drone strikes under a presidential decree signed by Putin that allows temporary state administration of critical infrastructure operators failing to defend against Ukrainian hacks and drone strikes. Although data centers are not formally critical infrastructure in Russia, the decree applies to them because other sectors depend heavily on cloud services; Russia has more than 180 data centers, over 80% in the European region within range of Ukrainian strikes. The digest also reports a Dropbox breach affecting nearly 5,000 accounts via the Lenovo ID integration, spyware attacks on at least 14 Serbians using NoviSpy or Pegasus, and a password recovery attack targeting hundreds of thousands of X accounts tied to the new X Money service. Other items include a 14-hour compromise of Coder's Cloudflare infrastructure delivering malicious Terraform modules, donor data breaches at Davayte and You Are Not Alone via the Stripe/WooCommerce integration, a $2.5M Aquifer crypto heist, and a TVING breach exposing data of almost 40 million accounts.

Risky Business News·Sep 4, 03:02 UTC · 12d agoPolicy & legal

What We Missed: Did ShinyHunters 'Breach' ReliaQuest?

Dark Reading editors discuss whether ShinyHunters breached ReliaQuest and new research questioning the prevalence of AI-generated malware.

Dark Reading editors review stories they had not previously covered in a video discussion, centered on recent activity attributed to the ShinyHunters threat actor and whether it constitutes a breach of security services firm ReliaQuest. The conversation also touches on new research about how common AI-generated malware actually is. No new indicators, victims, or technical details are provided beyond the discussion format.

Dark Reading·Sep 3, 19:42 UTC · 12d agoThreat actor

August 2026 Patch Tuesday forecast: How do we deal with the patch apocalypse?

August 2026 Patch Tuesday forecast urges risk-based triage as AI inflates CVE volume, flags actively exploited SharePoint RCE CVE-2026-50522 and LegacyHive Windows flaw.

July 2026 Patch Tuesday set records with over 600 CVEs, including 405 for Windows 11 and Server 2025, though only two were exploited zero-days and one was publicly disclosed. The author recommends prioritizing known-exploited and internet-facing vulnerabilities, matching patches to high-risk systems, and accelerating ring-based deployment toward Microsoft's suggested three-day turnaround. Notable items include actively exploited SharePoint RCE CVE-2026-50522 enabling machine key theft, the unassigned LegacyHive Windows User Profile Service flaw, and several end-of-servicing dates for Windows and Exchange.

Help Net Security·Aug 25, 06:52 UTC · 22d agoIndustry in the wildCVE-2026-505221

Wordfence Argus Finds Complex 6 Step Critical RCE in Avada Theme with 1 Million Sales

Wordfence's AI-assisted Argus found a six-step critical RCE chain in the Avada WordPress theme, which has more than one million sales.

Wordfence reports that its Argus research uncovered a complex six-step exploit chain yielding critical remote code execution in the Avada WordPress theme, one of the best-selling themes with over one million sales. The company also notes AI-assisted submissions to its bug bounty program grew from 16% to roughly two-thirds of all reports in recent months. Sites running Avada should apply the patched release.

Wordfence·Aug 25, 18:02 UTC · 21d agoVulnerability

Microsoft’s massive Patch Tuesday releases continue as AI reshapes bug discovery

Microsoft patches 419 vulnerabilities in record-breaking Patch Tuesday; Windows Winsock zero-day CVE-2026-68820 is actively exploited by Lazarus Group.

Microsoft's August Patch Tuesday fixes 419 vulnerabilities (62 critical, 357 important), among the largest monthly counts on record, following 206 fixes in June and 622 in July as AI-assisted discovery drives unprecedented volume. Three flaws are zero-days; Windows Winsock bug CVE-2026-68820 is exploited in the wild by Lazarus Group in job-themed attacks using PDFs with a trojanised reader. CVE-2026-62832, publicly disclosed by researcher Nightmare Eclipse via the LegacyHive PoC, is also patched. Microsoft now lists bugs by product family instead of itemized CVEs, which defenders warn complicates triage.

The Record·Aug 12, 12:36 UTC · Aug 12, 2026Vulnerability in the wildCVE-2026-68820CVE-2026-62832

What the AI Warning Letter Completely Missed

Opinion piece argues the recent AI warning letter identifies a risk window but omits which actors pose risks and who can mitigate.

This Dark Reading commentary critiques a recent AI warning letter for correctly identifying an approaching risk window while failing to name who is coming through it or who will close it. The piece is brief opinion commentary on AI risk discourse rather than a technical report.

Dark Reading·Sep 3, 17:23 UTC · 12d agoAI safety & security

N-able Patches Critical Zero-Day in N-central

N-able patches critical unauthenticated RCE zero-day CVE-2026-86218 in N-central, exploited in the wild; on-premises admins must apply hotfix 2026.3 HF4.

N-able released an urgent hotfix (2026.3 HF4) for CVE-2026-86218 (CVSS 10), an unauthenticated RCE in N-central exploited as a zero-day. Scanning/exploitation attempts observed from IP range 23.234.64.0/18 starting September 4; admins should check logs for scanning and unrecognized new accounts. The hotfix supersedes patches for CVE-2026-86206 and CVE-2026-86207, which Huntress observed potentially chained in the wild to bypass authentication in production environments.

SecurityWeek·Sep 8, 10:37 UTC · 7d agoExploit / PoC in the wildCVE-2026-86206CVE-2026-86207CVE-2026-86218

Hackers Turn Windows Shadow Copies Into a Tool for Credential Theft and Ransomware

Attackers abuse Windows VSS shadow copies to delete recovery points before ransomware and to extract NTDS.dit/SAM credentials, demanding context-aware detection.

Threat actors are weaponizing the Volume Shadow Copy Service (VSS) for two purposes: destroying local recovery points via vssadmin.exe, wmic.exe, diskshadow.exe, wbadmin.exe, and bcdedit.exe before encryption, and accessing static copies of locked files such as NTDS.dit and SAM for credential theft. Ransomware families tied to shadow-copy removal include Akira, Black Basta, BlackCat, Conti, LockBit, Qilin, RansomHub, REvil, Ryuk, and WannaCry. Huntress's analysis of the Nightmare-Eclipse tool showed the BlueHammer technique chaining a Windows Defender timing issue with a VSS snapshot to dump the SAM database and decrypt NT hashes. Defenders should correlate VSS operations with parent process, hive access, and subsequent encryption activity, and maintain immutable off-host backups.

GBHackers·Sep 15, 05:51 UTC · 1d agoResearch in the wild1

Adobe Patches Over 170 Vulnerabilities, Including Commerce Zero-Day

Adobe patched over 170 flaws, including in-the-wild zero-day CVE-2026-75650 (CVSS 10) in Adobe Commerce/Magento enabling unauthenticated RCE and web shell deployments.

Adobe released fixes for more than 170 vulnerabilities across Experience Manager, Acrobat Reader, Photoshop and other products. The Commerce zero-day CVE-2026-75650 (CVSS 10) allows unauthenticated code injection leading to remote code execution and has been exploited since September 4. Sansec reported multiple threat actors deploying backdoors and web shells via the bug, dubbed StyleSmuggler, which triggers injected code through Magento's Payment Transaction Failed Reminder email. Adobe also patched critical Campaign Classic command injection CVE-2026-82004 and two critical ColdFusion RCE flaws (CVE-2026-48273, CVE-2026-75746).

SecurityWeek·Sep 8, 18:37 UTC · 7d agoExploit / PoC in the wildCVE-2026-75650CVE-2026-82004CVE-2026-48273+1 CVEs1